CVE-2023-42476 Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

Medium 6.8 Published 12 Dec 2023 Updated 2 Aug 2024

An authenticated attacker can inject JavaScript into Web Intelligence documents, leading to data exposure or account takeover in the victim's browser.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-42476?

CVE-2023-42476 is a medium-severity cross-site scripting vulnerability in SAP_SE SAP BusinessObjects Web Intelligence, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.

Weakness: CWE-79

Which versions are affected by CVE-2023-42476?

It affects 1 product.

Products include Sap Businessobjects Web Intelligence.

How do I fix CVE-2023-42476?

No fix has been published for CVE-2023-42476 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-42476 being exploited?

There is no known exploitation of CVE-2023-42476 in the wild and no public exploit code.

Sources

Also known as GHSA-c9pm-pp53-grgr.